Web Services SOAP SOAP English Abstracts As the increasing dependency on information technologies, auditors are required to disclose the information o

Size: px

Start display at page:

Download "Web Services SOAP SOAP English Abstracts As the increasing dependency on information technologies, auditors are required to disclose the information o"

砚稍俞
7 years ago
Views:

1 Web Services A Study on Web Application Security Framework and Risk Control Policy Under Web Services Environment NSC H ( )

2 Web Services SOAP SOAP English Abstracts As the increasing dependency on information technologies, auditors are required to disclose the information of financial statements at continuous basis in order to prevent Internet fraud effectively. Web services resolve the communication problem so that the interoperability issues of disparity EDP system can be addressed. This trend has leaded the continuous auditing concept between CPAs and its auditees become possible. However, companies confidential financial information is easily exposed on public websites when it utilizes Web Services. Under the Web Services, SOAP (simple object access protocol) contains limited security mechanisms in order to protect information s confidentiality, integrity and availability. Therefore, we would like to study on Web application security framework and develop continuous review modules over the SOAP in order to monitor intercompany s transactions and network threats. In addition, past literatures have pay attentions to firewalls, intrusion detection systems (IDS) and other security products. However, it is also very important to address information security form management perspectives and identify the security management to higher-risk area. Keywords: Web Services, Accounting Information Systems, Computer-assisted Auditing Techniques (CAATs), Continuous Audit, Information Security 2

This trend has leaded the continuous auditing concept between CPAs and its auditees become possible.

3 Electronic Commerce Business Conducts Gartner Group B2B EC CERT(Computer Emergency Response Team) 52,658 security incidents , CERT Internet computer virus 1 Web Services [27][31][33] HTTP B2B EAI data-centric people-centric Web Services 2 [14] 3

incidents 2000 21,756 2001 CERT Internet computer virus 1 Web

4 Hidden Manipulation > Forcefull Browsing > Cross Site Scripting > (2) Misconfigurations > Known Volnerabilities > Parameter Tampering > (1) User Browser Netscape User Interface Code HTML Parser JavaScript, Active X Web Server IIS, Apache, iplanet Frontend systems PHP, Perl Weblogic, ColdFusion Backend systems Online Finance Online Medical Database Oracle, MySQL Data Payroll, Englineering Drawings Stasiak, 2002 web-based e-business Greenstein M. and Ray A., 2002 Pricewater CoopersPwC GRMS MSS e-trusted Accenture [1] Web Services [7][8][10][22] SOAP Web Services 4

ColdFusion Backend systems Online Finance Online Medical Database Oracle, MySQL Data Payroll, Englineering Drawings Stasiak, 2002 web-based

5 [1213] [78] (1) Web Trust(2) (3) (4) (5) e Internet Week EC (system security) Internet attack SETSSL Authentication Service password and access control fire wall 91 SOAP ebxml B2B [10] [111920] Web Services 5

6 COBITBS7799ISO17799VISA [781627] ISACA COBIT COBIT 34 IT Data Application Systems Technology Facilities People BS7799[7][8] ISO17799 VISA[27] B2C Web Services IDC B2B Cisco SystemsIBMIntelNortel Networks Symantec (IT-ISAC) [ B2B Dalton, Hill and Ramsey % Glover 6

Services IDC B2B 35 2004 89 Cisco SystemsIBMIntelNortel Networks Symantec 2000 1

7 & Romney 1998 Web Services Web Service 1. Web Services [21][22] Web Services SOAPWSDL UDDIXMLWeb Security 2. Web Services Web Services Web Services EDP Web Services Web Services 3. e e PwC GRMS Accenture 4. HTTP Continuous Monitoring Modules Exception Report Transaction Tagging plug-and-play 5. 7

Web Services Web Services Web Services EDP Web Services Web Services 3.

8 1 (2) 1. (COBIT, Control Objectives for Information and Related Technology)2. BS ISO VISA Web Services SOAPWSDL UDDI Web Services SOAP Web Services Web Services Web Services CORBA CORBA Web Services 8

Technology)2. BS7799 3.ISO17799 4.VISA5. 6. 7.

9 CORBA object reference Web Services SOAP Uniform Resource IdentifierURI SOAP HTTP HTTP Hop HTTP Web Services HTTP Proxy SSL 3. SOAP Web Application 4. 9

10 1. Web Services 2. COBIT ISO17799BS7799 VISA Web Services EDP CORBA CORBA 2.Wright1999 Wright

11 Office of Comptroller of Currency Security 2 Authentication 3 Trust 4 Non-repudiation 5 Privacy 6 Availability 4.Sofia Giannakoudi Security of the message authenticity identification integrity non-repudiation Confidentiality 2 Security of the environment 1.Pricewaterhouse Coopers (PwC)[1] 11

Office of Comptroller of Currency1999 1 Security 2 Authentication 3 Trust 4

12 PwC GRMS GRMS PwC PwC PwC ESAS ESAS ERPSAPPeoplesoftand Oracle PwC MSS MSS PwC e-trusted PwC 2.Accenture[1] 12

13 1. Web Services XML XML XML W3C WSDL XML SOAP XML 13

14 envelope HTTP XML RPC UDDI pointer 2.SOAP 14 SOAP SOAP Architecture SOAP (1) Request (2) (3) XML Web Server (4)XML XML consistency HTTP (5) XML HTTP XML TAG (6) XML Code (7) Request (8) HTTP (9) Request 1.COBIT[916] Information Systems Audit and Control Association, ISACA 1995 Control Objectives for Information and Related Technology COBITCOBIT IT ISACA ISACA 9 COBIT Business Requirement IT Resources IT processes COBIT

HTTP XML TAG (6) XML Code (7) Request (8) HTTP (9) Request 1.

15 3 COBIT 2. BS7799[78] BS7799 (British Standards Institution, BSI, 1999) BS ISO/ICE17799 ( 1999) BS VISA[27] B2C Visa [Visa00] Visa B2C B2B VISA Visa Visa [ 91 B2B EDP SOAP 15

BS7799 2000 12 1 ISO/ICE17799 ( 1999) BS7799 3.

16 (XMLWSDLSOAP UDDI) SOAP EDP SOAP Web COBITBS7799ISO 17799VISA 16

17 e (Web security) Web Services (Security Policy) 17

18 Web Services SOAP Web Services 1999 (1) (2) (3) (4) (XMLWSDLSOAPUDDI) 91 Microsoft Netscape HTML application platform 18

19 static active content e-commerce 1. (AV)2. (Code Signing)3. (Network Firewall)4. (Intrusion Detection System)5. (Content Filters)6. (Personal Firewalls)7. (Security Sandbox) SOAP Java SOAP 19

20 Java (Sun Microsystems, Inc.)1990 Java (consumer electronic devices) JAVA (World Wide Web) (Internet) Java JAVA (Object-Oriented) (1) (Simple)(2) (Secure)(3) (Interpreted)(4) (portable)(5) (Architecture-neutral)(6) (Multithreaded) (Object-Oriented Programming, OOP) Java Java C Java Java Java (Architecture-neutral) JAVA (platform-independent) JAVA SOAPSimple Object Access Protocol 1999 LotusIBM SOAP well-form XML HTTP SOAP SOAP W3C SOAP1.1 SOAP 1.0. HTTP XML Internet. Payload format SOAP HTTP 80 HTTP 80 SOAP SOAP SOAP XML

(portable)(5) (Architecture-neutral)(6) (Multithreaded) (Object-Oriented Programming, OOP) Java Java C Java Java Java (Architecture-neutral) JAVA

21 SOAP lightweight HTTP XML SOAP (CORBA, Java RMI, DCOM ) SOAP SOAP HTTP XML, port( http port 80),, SOAP HTTP (port 80), SOAP SOAP SOAP CORBA DCOM JAVA RMI HTTP HTTP PAM JAVA XML OBJREF SCM RMI SOAP ORB JAVA proxy IIOP HTTP GIOP Connection Connection -oriented -oriented 21

22 HTTP GIOP IIOP JAVA SOAP CORBA ( )CORBA DCOM SSL JAVA TCP/IP RMI HTTP HTTP 2003 SOAP W3C 2000 XML-based SOAP Message Structure 1.SOAP Envelop. 2.SOAP Encoding Rule. 3.SOAP RPC Representation. HTTP Header POST / ObjectURI HTTP/1.1 SOAPMethodName SOAP Envelop Namespace for Version Namespace for Encoding SOAP Header Name, namespace, actor Object Endpoint ID Interface Identifier Method Identifier Extension Element 1, namespace SOAP Body Name, namespace, actor Element 1, namespace Attributes and URI Parameter Data Message Structure of SOAP 22

23 Web Services 2 SOAP Web Services SOAP 1.2 (security) (reliable) SOAP (reliable and secured SOAP platform or RS-SOAP) (install) (incident response system, or IRS) (prototype) (concept-proving) SOAP Web SOAP Continuous Monitoring Module (1) SOAP SOAP Application API SOAP SOAP API Application Server Processor Processor Server INPUT Action SOAP H Task comp comp C H request T C JAVA XML T T XML JAVA WORK VB parser T P parser VB OUT COME Result comp P SOAP Response Result Comp SOAP message exchange models 23

24 Kenn Scribner, Mark Stiver, Kennard Scribner, (2001). SOAP XML SOAP XBRL SOAP XML XBRL JAVA SOAP Application API SOAP SOAP API Application Server Processor Processor Server INPUT Action X SOAP H X Task comp comp B H request T B JAVA R T T R JAVA WORK L T P L OUT COME Result comp parser P SOAP Response parser Result Comp XBRL JAVA SOAP message exchange models Jarvenpaa Tiller1999 Smith e Kalakota Whinston

25 E-Business E-Commerce EB EC ProtocolTCP/IP File Transfer ProtocolFTP Hypertext Transmission ProtocolHTTP Browser Web Page [2122] CORBA 25

26 Web Services XML SOAP WSDL )UDDI Web Services [781733] SOAP Scott Seely, 2002 COBITBS7799ISO17799VISA COBITBS7799 ISO17799 VISA 26

27 World Wide Web 1 2 Dam and Wesley1997 confidentiality integrity availability validity 2000 Kees2002 I t ()Inter

28 2002 Computer Security Institute; CSI IT SAS 94 SP SP ISO ISO COBIT SAS 94 SP ISO ISO COBIT IT 28

29 IT IT IT 8 14 (SP800-14) IT 33 (SP800-27) IT Fredric2002 General accepted auditing standards, GAAS General accepted accounting principle, GAAP COBIT Markus Gaulke

30 30 Markus Gaulke2002 Markus Gaulke2002 Wright 1999 ( ) ( ) ( ) ( ) ( ) ( )

31 Caelli, et. al,1989 Caelli Caelli, et al.,

32 1. (COBIT)2. BS ISO VISA 5. COBITBS7799ISO17799 COBIT Information System Audit and Control Association COSOCadbury COCO Security Code of Conduct Department of Trade and Industry Security Hand book-national Institute of Standards and Technology COBIT COBIT DS1 PO1 DS2 PO2 DS3 PO3 DS4 PO4 DS5 PO5 DS6 PO6 DS7 AI1 AI2 PO7 DS8 AI3 PO8 DS9 AI4 PO9 DS10 AI5 PO10 DS11 AI6 PO11 DS12 DS13 COBIT ( COBIT 3re ed.) COBIT COBIT 3re ed. BS ISO

33 VISA BS ISO/IEC17799 [212] Web Services [12] 33

34 Web Savices HTTP Web Security B2B Web Services Web SOAP SOAP (prototype) SOAP 4. SOAP SOAP WSDLUDDI Web Services 34

35 TCSEC CORBA COBIT pp.187~ BS Information Security Services: A Competitive Segmentation and Analysis, 15.AICPA and Canadian Institute of Chartered AccountantsCICA, Continuous Auditing AICPA and CICA. Electronic Commerce Assurance Services Task Force. WebTrust Principles and Criteria for Business-Consumer Electronic Commerce, Feb Ver American Institute of Certified Public Accountant, Auditing in Common Computer 35

36 Environments, AICPA, New York, American Institute of Certified Public Accountant, Auditing with Computers, AICPA, New York, Allen Julia H., The CERT Guide to System and Network Security Practices, Addison-Welsey, BS7799-1, Information Security Management-Part1 Code of Practice for Information Security Management, British Standard Institution, London., BS7799-2, Information Security Management-Part2Specification for Information Security Management Systems, British Standard Institution, London., Caelli, W., D. Longley and M. Shain(1989).Information Security for Managers, Stockton Press, New York. 23.Carmichael, D. R. J. H. Willingham, and C. A. Schaller, Auditing Concepts and Methods-A Guide to Current Theory and Practice, McGraw-Hill, 1996, 6 th ed. 24.Chirillo John, Hack attacks denied - a complete guide to network lockdown, Donaldson Mark, Inside the Buffer Overflow Attack: Mechanism, Method, & Prevention, 26.Finne,T.,Information Systems Risk ManagementKey Concept and Business 27.Fraud & Security, February, 9-12, Gibbs T. E., and R. G. Schroeder, External Auditor Criteria for Evaluating Internal Audit Departments, The Internal Auditor, pp Dec Information System Audit and Control Foundation, COBIT-Audit Guidelines 2 nd Edition, April, Groomer, S.M. and U.S. Murthy, Continuous Auditing of Database Applications: An Embedded Audit Module Approach, Journal of Information Systems, Spring Halliday, S. (1996), A Business Approach to Effective Information Technology Risk Analysis and Management, Information Management & Computer Security, 4/1, Kalakota Ravi, & Andrew B. Whinston, Electronic Commerce; A Manager s Guide, Addision Wesley, Ko Calvin, Paul Brutch, Guy Tsafnat, Jeff Rowe, Karl Levitt Advanced Security Research Journal NAI Labs Volume IV, Number I, Winter Lin Fengyi, Deron Liang, Soushan Wu Electronically Auditing EDP Systems With the Support of Emerging Information Technologies, International Journal of Accounting Information System, Lin Fengyi, Deron Liang, Soushan Wu and Ray M. Yang, An Integrated Auditing 36

37 Architecture for Internet and Information system Design under a CORBA Environment, Review of Accounting Information Systems, Vol.4 No.1, Winter Parker, D.B. Information Security in a Nutshell, Information Systems Security, Spring, 1997, Process, Computer & Security, 19, 3, 2000, Software Architectures. IEEE DISCEX II vol. II. Jun Subramanya, S.R., Lakshminarasimhan, N. Computer viruses. IEEE Potentials. Oct Visa Account Information Security Standards, visa.com/nt/gds/standards.html(2000). 41.Simple Object Access Protocol (SOAP) 1.1, 42.SSI Ltd., et at., General Ledger Facility, OMG DTC Document finance/ , Stasiak, k. Web Application Security, IScontrol,Vo1 6, The ISO Service & software Directory, The Benefit of Security Risk Analysis, Wright, M., Third Generation Risk Management Practices, Computer 45.UDDI White Paper, 46.Vasarhelyi, M. A. & Halper, F. B., The Continuous Audit System: A UNIX-Based Auditing Tool, The EDP Auditor Journal,1991, pp W3C, XML Stylesheet Language Transformation Specification, 48.Wright, M, Third Generation Risk Management Practices, Computer Fraud & Security, February,9-12., Zwass V., Electric Commerce: Structures and Issues, International Journal of Electric Commerec, Fall

epub 79-1

epub 79-1 1 XML X M L X M L X M L We b 1.1 markup language M L M L A S C I I A S C I I C 0 0 0 1 F C R - L F M S - D O S M S - Wi n d o w s U n i x L F M a c O S C R A S C I I A S C I I -. - -. C C + + { }. b e